fix(deps): upgrade vitest 2→4, resolve all npm audit findings

CHANGELOG.md

@@ -5,6 +5,16 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Fixed
+
+- **Roaring native module loading under Bun** — `initRoaring()` now catches dynamic `import('roaring')` failures and falls back to `createRequire()` for direct `.node` binary loading. Bun Dockerfile updated to install `nodejs`, `python3`, and `ca-certificates` so that `node-pre-gyp` can download or compile the roaring native binary (Bun reports a fictional Node ABI v137 with no prebuilt available). Fixes `test-bun` CI failures caused by missing native binary after Vitest 4 upgrade invalidated Docker layer cache.
+
+### Changed
+
+- **Vitest 2.1.9 → 4.0.18** — major test framework upgrade. Migrated deprecated `test(name, fn, { timeout })` signatures to `test(name, { timeout }, fn)` across 7 test files (40 call sites). Fixed `vi.fn().mockImplementation()` constructor mocks to use `function` expressions per Vitest 4 requirements. Resolves 5 remaining moderate-severity npm audit advisories (`esbuild` [GHSA-67mh-4wv8-2f99](https://github.com/advisories/GHSA-67mh-4wv8-2f99), `vite`, `@vitest/mocker`, `vite-node`, `vitest`). **`npm audit` now reports 0 vulnerabilities.**
+
 ## [13.0.1] — 2026-03-03
 
 ### Fixed

docker/Dockerfile.bun

@@ -2,19 +2,34 @@
 # Runs: API integration tests only (vitest via bunx).
 # CLI tests are excluded — the CLI uses node: built-ins.
 # Build context is the parent monorepo directory (context: ..).
+
+# ---------- Stage 1: build roaring native module with Node.js ----------
+# bun install blocks lifecycle scripts by default, and Bun reports a
+# fictional Node ABI (v137) that has no prebuilt binaries. We use a
+# Node.js stage to download or compile the correct native binary.
+FROM node:18-slim AS roaring-builder
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    make g++ python3 && rm -rf /var/lib/apt/lists/*
+WORKDIR /build
+COPY git-warp/package*.json ./
+RUN npm install --ignore-scripts
+RUN cd node_modules/roaring && npx --yes node-pre-gyp install --fallback-to-build
+
+# ---------- Stage 2: Bun runtime ----------
 FROM oven/bun:1.2-slim
-# make/g++: native module compilation (roaring bitmaps).
-# No bats/python3 — BATS CLI tests are Node-only.
 RUN apt-get update && apt-get install -y --no-install-recommends \
     git \
-    make \
-    g++ \
     && rm -rf /var/lib/apt/lists/*
 WORKDIR /app
 COPY git-warp/package*.json ./
 COPY git-warp/scripts ./scripts
 COPY git-warp/patches ./patches
 RUN bun install
+# Copy the compiled roaring native binary from the builder stage.
+# The binary lands in build/Release/ which is roaring's MODULE_NOT_FOUND
+# fallback path — Bun finds it there when node-pre-gyp's ABI lookup fails.
+COPY --from=roaring-builder /build/node_modules/roaring/build/ node_modules/roaring/build/
+COPY --from=roaring-builder /build/node_modules/roaring/native/ node_modules/roaring/native/
 COPY git-warp .
 # Init a git repo so plumbing operations work inside the container.
 RUN git init -q \